There's a SLAPI plugin for 389 DS which supports MIT Kerberos. A C programmer
might be able to adapt this as an OpenLDAP overlay (similar to OpenLDAP's
slapo-smbk5pwd).

Sorry, couldn't one use the SLAPI plugin as is in OpenLDAP, since SLAPI
support is available (SLAPI plugins are supposed to be able to work
without modifications on all LDAP servers)?

"supposed to" and "actual" tend to be quite different, since the inventors of
SLAPI diverged from each other (Sun/Netscape/RedHat...), and OpenLDAP's
implementation is rather sparse, and only fleshed out on an as-needed basis.

(For example, Symas and LTB packages are SLAPI-enabled; I had tested
such a SLAPI plugin and it worked fine.)